[Feature Request] Keep sourceRef with case

[zpriddy]

Request Type

Feature Request

Request

It would be very helpful to keep the sourceRef(s) with the case when an alert is turned into a case. This would be useful in cases where you would like to call a webhook and respond to the service that generated the alert.

for example if PagerDuty generated an alert with sourceRef = 123abc When that alert is turned into a case I would like to acknowledge it in PagerDuty and when its closed i'd like to resolve it in PagerDuty. However as soon as the case is created i lose the sourceRef

Possible Solutions

store and object in the case of sourceRefs=[{source:sourceRef}] so for example sourceRefs=[{"pagerduty":"123abc"}]

This would work with multiple alerts merged into one case

sourceRefs=[
     {"pagerduty":"123abc"},
     {"pagerduty":"847hfg"},
  ]

[zpriddy]

With the changes in #687 this is something that might be able to be done with custom fields if we were able to add custom fields into the Alert and have them carry over to the case.

[nadouani]

With the changes in #687 this is something that might be able to be done with custom fields if we were able to add custom fields into the Alert and have them carry over to the case.

This is possible, when your define a custom field in an alert, it's copied to the case.
If this is not working, please let us know.

I'll close the issue, and please feel free to reopen it if needed.

[zpriddy]

With the changes in #687 this is something that might be able to be done with custom fields if we were able to add custom fields into the Alert and have them carry over to the case.

This is possible, when your define a custom field in an alert, it's copied to the case.
If this is not working, please let us know.

I'll close the issue, and please feel free to reopen it if needed.

Yup that worked! Thanks! There was no API documentation about customFields in alerts and it wasnt in theHive4py so i was not aware that this could be done

[zpriddy]

@nadouani
I was thinking about this the other day in relation to #856
I feel like the sourceRef should me automatically added into the metadata of the case (even if it is a custom field that is not displayed until defined) just so you can go back and forth with the case <-> alert (and following alert etc) and i dont think this is something that should have to be done manually for each alert. I was wondering your thoughts on this?

[smogm]

Hello @zpriddy and @nadouani, this may be related to this as well: #1647